Extracted

• • Target
    70a993959b30cb64aa9460e8937c5108173819ac1b522329b69853eaa28fd02d
  • Size 45KB
  • SHA256 70a993959b30cb64aa9460e8937c5108173819ac1b522329b69853eaa28fd02d
  • MD5 0efb9c0035061657e456835cb28b71c5
  • SHA1 f0d39a8a2cbf5fa738b2045a9250b82de032ba05
  • SHA512 fb8e1b1e737cb0c4f798851b3ae833d64b77382378427f88cb67ffe31cca8bfcd2beb924f61dbdeba185bf41c30396aa92cbcdc6aa30d6648cf45e8ccef13682
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFPUJ+XOoJ9hU/NPIEfzjbhgX3ikD0Y5jEf1GKAtH55s:MuLAZTnbg2CU0eI9hyqEf3bOXSkwYN0p
  • TLSH
    T154232B003BE8812BF2BF4F786CF26145867AF6637603D55E1CC4519B5613BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2